test(matchers): fixed windash modifier test #1392

Yamato-Security · Aug 10, 2024 · 10f3971 · 10f3971
1 parent 090e153
commit 10f3971
Showing 1 changed file with 48 additions and 1 deletion.
diff --git a/src/detections/rule/matchers.rs b/src/detections/rule/matchers.rs
@@ -3069,10 +3069,57 @@ mod tests {
  }
  }"#;
 
+ let record_json_str_en = r#"
+ {
+ "Event": {
+ "System": {
+ "EventID": 1,
+ "Channel": "Microsoft-Windows-Sysmon/Operational"
+ },
+ "EventData": {
+ "CommandLine": "test –addstore"
+ }
+ }
+ }"#;
+
+ let record_json_str_em = r#"
+ {
+ "Event": {
+ "System": {
+ "EventID": 1,
+ "Channel": "Microsoft-Windows-Sysmon/Operational"
+ },
+ "EventData": {
+ "CommandLine": "test —addstore"
+ }
+ }
+ }"#;
+
+ let record_json_str_horizontal = r#"
+ {
+ "Event": {
+ "System": {
+ "EventID": 1,
+ "Channel": "Microsoft-Windows-Sysmon/Operational"
+ },
+ "EventData": {
+ "CommandLine": "test ―addstore"
+ }
+ }
+ }"#;
+
  check_select(rule_str_en_dash, record_json_str, true);
+ check_select(rule_str_en_dash, record_json_str_en, true);
+ check_select(rule_str_en_dash, record_json_str_em, true);
+ check_select(rule_str_en_dash, record_json_str_horizontal, true);
  check_select(rule_str_em_dash, record_json_str, true);
+ check_select(rule_str_em_dash, record_json_str_en, true);
+ check_select(rule_str_em_dash, record_json_str_em, true);
+ check_select(rule_str_em_dash, record_json_str_horizontal, true);
  check_select(rule_str_horizontal_bar, record_json_str, true);
- check_select(rule_str_horizontal_bar, record_json_str, true);
+ check_select(rule_str_horizontal_bar, record_json_str_en, true);
+ check_select(rule_str_horizontal_bar, record_json_str_em, true);
+ check_select(rule_str_horizontal_bar, record_json_str_horizontal, true);
  }
 
  #[test]